Stellar Cyber 6.5.0 Release Notes

Software Release Date:
Release Note Updated:

The Stellar Cyber 6.5.0 release delivers the following updates to the Stellar Cyber Open XDR platform.

The release notes are organized into the following sections:

Highlights

Early Access Program Features

  • Stellar Cyber MCP Server: Added an MCP server to connect AI clients to the Stellar Cyber Platform through the Model Context Protocol (MCP) to retrieve case and alert data, review investigation context, perform tenant-aware operations, and update selected case fields.

  • Parser Studio: Added Parser Studio to create and manage custom log parsers for data ingestion by cloning existing parsers, testing parser behavior before deployment, and activating parsers for production log ingestion.

Detections/Machine Learning

  • Successful Login After Brute Force: Added a detection for successful login activity from a new or previously unseen IP address shortly after brute-force login attempts targeting the same user account from different IP addresses, helping identify distributed or rotating-IP brute-force attacks.

  • Suspicious AWS Configuration: Added built-in detection coverage for AWS Config events so configuration changes and compliance evaluation events can generate alerts and correlate with other AWS telemetry.

  • Location-Based Detection Fidelity Scoring: Improved fidelity scoring for location-based detections by refining how new location, ASN, and user agent changes affect alert accuracy, helping reduce false positives and improve triage for User Login Location Anomaly and Impossible Travel Anomaly.

System

  • ATH Rules Import/Export: Added ATH rule import and export functionality so you can move rules between environments, include referenced queries and lookups, validate dependencies before import, and resolve naming conflicts with skip, overwrite, or rename options.

  • Query Execution Management: Enhanced ATH playbook status views with a Last Scheduled Run section that shows the most recent scheduled run attempt, including details about the input status, condition status, and action status.

Usability

  • Dashboard Landing Page: Added a dashboard landing page called Dashboard Hub to centralize access to existing dashboards and charts so you can browse, open, and edit them from one place based on your current permissions.

  • Alert Filters for a Fixed Period of Time: Added expiration settings for alert filters so you can apply filter actions temporarily during maintenance windows, planned changes, or other short-term events and have them deactivate automatically when the specified time period ends.

Integrations

  • New Integrations: Expanded third-party integration coverage across network security, cloud and SaaS security, cyber asset and exposure monitoring, and XDR response platforms to improve data ingestion, broaden security visibility, and support more coordinated detection and response workflows.

Actions Required

There are no actions required in this release.

Behavior Changes

Changes that affect the way users interact with the product or interpret results are listed below.

  • AELDEV-67120: Updated the login flow to avoid revealing whether a user exists before authentication completes. Failed login attempts now return the same result whether the username, password, or both are incorrect. All login flows also display the Continue with SSO button, and the tenant-specific logo that previously appeared after a user entered an email address now only appears after login. These changes help prevent attackers from using the login flow to identify valid accounts.

  • DATA-3291: Updated the Trend Micro Interscan Messaging parser to use port 5684 instead of port 5678. Deployments that previously sent logs to port 5678 must be updated to send traffic on port 5684, including any related firewall policy changes. Logs that continue to arrive on port 5678 will no longer be ingested by the Trend Micro Interscan Messaging parser.

Deprecated Features

  • Office 365 Reporting Web Service connector – Microsoft deprecated the Reporting Web Service for message trace collection on April 8, 2026. Stellar Cyber provides the Microsoft Graph Message Trace connector as the replacement for message trace collection. Migrate existing Reporting Web Service configurations to the new connector.

  • Netskope Connector (API V1) – API V1 support was removed from the Netskope connector. API V2 is now the default option.

Detection/ML

New Features

Improvements

Stellar Cyber Platform

New Features

Improvements

  • Improved correlation rule evaluation in Automated Threat Hunting so rules can complete more reliably when processing large result sets and complex chained queries. Long-running rules are now less likely to stop before finishing in high-volume environments or with longer lookback windows, which helps reduce missed matches.

  • Added support for configuring alert filters to remain active only for a specified period of time. You can now set an expiration for an alert filter so it applies during a maintenance window, planned change, incident mitigation period, or other temporary need, and then deactivates automatically. This helps you avoid leaving temporary alert filter changes in place longer than intended.

Sensors

New Features

Improvements

Connectors

New Features

Improvements

Parsers

New Features

  • Early Access Program participation is required to use this parser with Parser Studio. Contact your Stellar Cyber representative for information.

    Added a modular built-in NetScout Omnis parser for Parser Studio. This parser handles priority-prefixed messages with Common Event Format (CEF) headers and extracts CEF header fields and extension key-value pairs. You can clone this parser and customize it in Parser Studio. Normalization closely matches the existing NetScout Omnis parser to preserve compatibility for detections and dashboards while providing the performance benefits of the modular parser framework.

  • Early Access Program participation is required to use Parser Studio. Contact your Stellar Cyber representative for information.

    Added Parser Studio as a management workspace for creating and managing custom parsers for data ingestion. With Parser Studio, you can view built-in and custom parsers, create new custom parsers by cloning modular built-in parsers (Fortinet Fortigate and NetScout Omnis in this release) and previously created custom parsers, test parser behavior before deployment, and activate parsers for production use.

  • Expanded the Zscaler Internet Access (ZIA) Firewall parser to support the 38-field CSV log format used by default in some Nanolog Streaming Service (NSS) server configurations. The parser now extracts and normalizes additional fields from this format, including user, network, session, byte-count, threat, and device metadata. This improvement lets you ingest and search these Zscaler ZIA Firewall logs without requiring an alternative export format when the 38-field layout is used.

  • Added a built-in parser for ingesting Cato Networks Cato Security logs in custom JSON format over HTTP POST on port 6094. This parser normalizes Cato security events received through a Splunk HEC-compatible log stream. It expands visibility into Cato-delivered security telemetry and improves correlation of cloud security events in Stellar Cyber.

  • Added a built-in parser for ingesting Citrix ADC (Application Delivery Controller) logs in RFC 5424 syslog format on port 6095. This parser extracts syslog header fields and Citrix ADC event data for administrative actions, VPN sessions, and network connection activity, providing information about users, IP addresses, ports, protocols, and traffic volume. This parser improves visibility into Citrix ADC administrative and VPN activity and supports more consistent traffic analysis and investigation.

  • Added a built-in parser for ingesting Palo Alto Networks Prisma Access logs in Log Event Extended Format (LEEF) on port 5522. This parser normalizes Prisma Access traffic and threat events, maps key network, user, file, email, and severity fields, and routes threat-category events to the IDPS/Malware Sandbox Events data domain while routing qualifying network events to Traffic. This parser improves visibility into Prisma Access activity and supports more accurate analysis of firewall traffic and threat detections.

  • Added a built-in parser for ingesting WordPress logs in key-value pair format on port 6093 over UDP. This parser classifies WordPress web application events under the weblogs category. It improves visibility into WordPress web activity and supports broader analysis of web application security events.

  • Early Access Program participation is required to use this parser with Parser Studio. Contact your Stellar Cyber representative for information.

    Added a modular built-in Fortinet Fortigate parser for Parser Studio on port 8517. his parser handles priority-prefixed messages with Common Event Format (CEF) headers, extracts CEF header fields and extension key-value pairs. You can clone this parser and customize it in Parser Studio. Normalization closely matches the existing Fortinet FortiGate parser to preserve compatibility for detections and dashboards while providing the performance benefits of the modular parser framework.

  • Added a built-in parser for ingesting Salt Security logs in RFC 5424 syslog and Common Event Format (CEF) on port 6088. This parser normalizes source and destination IP addresses into top-level network fields. It improves visibility into API security activity and enables more reliable correlation, search, and firewall response actions for Salt Security events.

  • Added a built-in parser for ingesting DefensX logs in Common Event Format (CEF) on port 5143. This parser extracts DefensX event attributes from name and value pairs in the message data, including risk score, category key, source, request context, device identifier, and external device identifier, and maps them to searchable fields. This parser improves visibility into DefensX activity and supports more effective filtering, correlation, and investigation.

  • Added a built-in parser for ingesting Fortra GoAnywhere MFT logs in vendor custom format with RFC 5424 syslog on port 6091. This parser classifies managed file transfer activity. It improves visibility into managed file transfer operations and supports analysis of file movement activity across the environment.

  • Added a built-in parser for ingesting Zecurion - DLP (CEF) logs in Common Event Format (CEF) on port 5143. This parser captures additional Zecurion DLP extension fields and populates normalized event attributes for search, correlation, and reporting. This parser improves visibility into data loss prevention events and makes Zecurion DLP activity easier to analyze and report on.

  • Added a built-in parser for ingesting OpenText -Open Enterprise Server logs in Common Event Format (CEF) on ports 5143 or 5870 over TCP. This parser normalizes file access activity from Open Enterprise Server, including user identity, file path, process, outcome, and connection information, to make these events easier to search and analyze. This parser improves visibility into file access operations and supports more effective investigation of file activity on OpenText - Open Enterprise Server systems.

  • Added a built-in parser for ingesting ManageEngine OpManager Plus logs in RFC 5424 syslog format on port 6090. This parser extracts ManageEngine OpManager Plus events and preserves unmapped message elements in searchable custom value fields for correlation and investigation. This parser improves visibility into infrastructure monitoring activity and makes OpManager Plus events more useful for search and analysis.

  • Added a built-in parser for ingesting SoftEther VPN Server logs in SoftEther custom format on port 6089. This parser covers SECURITY_LOG and SERVER_LOG messages and normalizes authentication, connection, and management events into standard fields for correlation and detection. This parser improves visibility into VPN activity and supports more effective analysis of remote access and administrative events.

  • Added a built-in parser for ingesting Devolutions Remote Desktop Manager logs in vendor custom JSON format on port 6087. This parser normalizes remote session lifecycle data, including Remote Desktop Protocol and Secure Shell connections, credential viewing activity, usernames, remote hosts, machine names, connection types, and session identifiers into searchable attributes. This parser improves visibility into privileged remote access activity and strengthens investigation of administrative sessions and identity-based events.

  • Added a built-in parser for ingesting Spica Access Control logs in vendor custom format with JSON on port 6092. This parser extracts physical access control events, normalizes access results and user identity attributes, and classifies access-granted, access-denied, and badge-registration activity for consistent analysis. This parser improves visibility into physical access events and supports stronger correlation with identity, VPN, and directory activity.

  • Added a built-in parser for ingesting IIJ SWG (Internet Initiative Japan Secure Web Gateway) logs in Internet Initiative Japan custom format on port 6086. This parser extracts client address, timestamp with timezone offset, request method, protocol version, target host and port, response status, bytes sent and received, and request duration when present, with full support for CONNECT requests. This parser improves visibility into secure web gateway activity and supports more consistent analysis of proxy traffic.

Improvements

  • Improved parser configuration propagation so modular parser settings are automatically redeployed to the data sensor when the Configuration Manager reassigns the sensor to a different tenant. Parsing remains aligned with the new tenant context without requiring a manual sensor restart or user action.

  • Added support in Parser Studio for mapping the value in a single raw field to multiple Stellar Cyber schema fields when you configure a custom parser. This improvement gives you more flexibility during normalization and reduces the need for workarounds when one parsed value needs to populate more than one top-level field.

  • Updated the Fortinet FortiAnalyzer parser to normalize additional Fortinet antivirus and file-related fields, including virus, file hash, file name, destination user, and ICMP type fields. The update also corrected normalization of rcvddelta and sentdelta to inbytes_delta and outbytes_delta. This improvement expands FortiAnalyzer field coverage and keeps detections and investigations more consistent.

  • Enhanced the BlueCoat Proxy SG parser to support RFC 3164 syslog messages and additional message_id patterns for newer log content. This improvement expands log format coverage for BlueCoat Proxy SG events and improves parsing reliability for updated message variants.

  • Added JSON-format support to the Zscaler Internet Access (ZIA) firewall parser on port 5549. The parser now auto-detects and processes both JSON and CSV firewall logs concurrently, including mixed-format streams. This improvement expands Zscaler ZIA firewall log format coverage and lets customers ingest JSON and CSV logs through the same listener.

  • Expanded the F5 BIG-IP Application Security Manager (ASM) parser to capture additional Bot Defense-specific fields from F5 BIG-IP ASM events. The update adds support for fields such as bot name and related Bot Defense attributes. This improvement gives you better visibility into bot classifications and mitigation outcomes in F5 BIG-IP ASM events, making it easier to identify suspicious automated traffic and investigate how Bot Defense handled each request.

  • Added TCP multi-line support to the Fortinet FortiAnalyzer parser on TCP port 5542. The parser now recognizes a leading priority marker followed by a key-value string as a new event and preserves event boundaries across TCP segments. This improvement expands FortiAnalyzer ingestion support for TCP forwarding and helps maintain reliable parsing when FortiAnalyzer logs are sent over TCP instead of UDP.

  • Extended the ESET parser to derive event.timestamp from log.syslog.timestamp, honoring the Z designator and numeric offsets in the syslog header. The occured payload field no longer overrides event.timestamp when it omits a timezone, and its original string remains available for reference. This improvement prevents offset errors on sensors configured with non-UTC time zones and preserves more accurate event timing.

  • Extended the ThreatER Enforce parser to normalize syslog timestamps that omit a timezone indicator. Parsing now accepts ISO 8601 timestamps with or without a trailing Z or numeric offset, and when no indicator is present, the parser assumes the sensor time zone. This improvement prevents future-dated events and preserves event ordering during ingestion.

  • Extended the F5 BIG-IP i2600 parser to parse XML-formatted payloads in f5-full_request in addition to JSON. The parser automatically detects JSON or XML and normalizes elements, attributes, and text into fields, with nested structures mapped to dotted field names and repeated elements represented as arrays. This improvement makes extracted request data available for queries, dashboards, and detection policies across both payload formats.

  • Improved the FortiGate CEF parser to expand extraction for event:vpn logs and populate additional Fortinet fields from msg_data, including the authenticated user, VPN tunnel name, tunnel type, tunnel identifier, tunnel IP address, assigned IP address, authentication group, alternate user value, and request cookies. This improvement expands field coverage for IPsec VPN tunnel events and makes user and tunnel details easier to search and analyze.

  • Improved the Tait Communications Radio Frequency Subsystem (RFSS) Controller parser to handle audit syslog messages that append a dot-delimited port number to the source IP address. The parser now separates the source IP address and source port, and extracts fields such as username, authentication method, access level, and login result from TaitNet-audit login events. This improvement makes Tait RFSS Controller login activity easier to search and investigate, especially when reviewing how users authenticated and whether access attempts succeeded.

  • Extended the FortiAnalyzer parser to extract additional fields from FortiMail, FortiGuard, and FortiWeb logs forwarded through syslog on port 5542. The parser now captures more values from msg_data and normalizes common attributes for search and correlation. This improvement makes forwarded Fortinet product logs more useful for investigation and helps preserve visibility when these events are sent through FortiAnalyzer instead of directly from the original device.

  • Improved the FortiADC parser to support whitespace-delimited key-value logs while continuing to support comma-delimited records. The update also expands extraction for device details, severity, virtual domain, service, source and destination addresses and ports, policy, action, and additional Web Application Firewall (WAF) request fields. This improvement increases FortiADC log coverage and makes FortiADC and WAF events easier to search and analyze.

  • Added RFC 5424 syslog header parsing to the Citrix NetScaler parser so SSL handshake events such as SSL_HANDSHAKE_SUCCESS can be parsed alongside previously supported formats. The update parses fields such as SPCBId, ClientIP, ClientPort, VserverServiceIP, VserverServicePort, ClientVersion, and CipherSuite. This improvement expands Citrix NetScaler log format coverage while preserving compatibility with existing sources.

  • DATA-3291: Reassigned the Trend Micro Interscan Messaging parser to port 5684.

    Reassigned the Trend Micro Interscan Messaging parser to port 5684 and disabled ingestion on port 5678. Trend Micro events are now accepted only on port 5684, which prevents unrelated syslog traffic such as MikroTik logs from being misclassified as Trend Micro data. If your deployment previously sent Trend Micro logs to port 5678, update sender and firewall configurations to allow traffic on port 5684.

  • Expanded the Zscaler Internet Access (ZIA) Web parser to support RFC 5424 syslog headers wrapped around vendor JSON payloads and the 34-field comma-separated values (CSV) export format. The update also corrected field extraction and key-to-value alignment so important ZIA web log attributes are mapped consistently to normalized fields. This improvement broadens ZIA Web log format coverage and makes parsed events more reliable for search and investigation.

  • Added normalization for Microsoft Sysmon Event ID 3 network connection events to populate the normalized source and destination IP address fields from the raw event values. The update applies to events ingested through both the Windows Server Sensor and NXLog while preserving the original raw fields. This improvement makes endpoint network connection events easier to investigate with IP-based watchlists, subnet filters, and correlation.

  • Expanded the Ubiquiti UDM (UniFi Dream Machine) Pro parser to support intrusion detection and intrusion prevention logs from UniFi OS 5.0.12 and UniFi Network Application 10.1.85, including messages with or without a syslog timestamp and with bracketed zone tags. The update extracts additional network and interface fields and normalizes source and destination addresses, ports, and protocol values. This improvement expands coverage for newer Ubiquiti IDS and IPS log formats and makes these events more useful for search, dashboards, and detections.

  • Expanded the ESET PROTECT parser to support additional non-JSON message formats, including RFC 5424 heartbeat events. The parser now extracts standard syslog headers and ESET event content while continuing to support existing JSON-based events. This improvement prevents parse errors on newer ESET heartbeat and status messages and preserves consistent ingestion across supported formats.

  • Broadened the Trend Micro Deep Discovery Email Inspector Common Event Format (CEF) parser to extract additional email and threat-related fields, including device MAC address, message UUID, recipient email address, message ID, latest status, translated device address, rule criteria, rule name, threat type, file type, file size, and message size. This improvement increases visibility into email inspection activity and makes these events more useful for search, dashboards, and detections.

  • Added normalization and enrichment for the CrowdStrike Common Event Format (CEF) parser in Alert Integration. Events now map process, file, host, user, and network attributes to Stellar Cyber canonical fields for consistent correlation and analytics. This improvement makes CrowdStrike alerts more useful in correlation, analytics, and case workflows without requiring configuration changes.

  • Expanded the Fortinet FortiEDR parser to extract structured fields from supported audit log patterns instead of leaving key details only in the Fortinet description field. The update adds parsing for events such as login, logout, failed login, two-factor authentication, classification changes, exceptions, archived events, resolved applications, and events marked as read. This improvement makes FortiEDR audit events easier to filter, sort, dashboard, and automate.

  • Added parsing for Deciso OPNsense filterlog messages. The parser extracts source and destination addresses and ports, protocol, action, interface, rule number, tracker, and related protocol attributes, and classifies the events as firewall activity. This improvement makes OPNsense filterlog events available for firewall analytics, detections, and investigation.

Usability

New Features

Improvements

Early Access Program

If you're interested in testing out new features ahead of general availability, consider joining the Early Access Program (EAP) by contacting your Stellar Cyber Customer Success representative and telling them which EAP feature you want to test. Once you've agreed to the EAP terms and signed up, the EAP feature is unlocked for you.

The purpose of this program is to boost performance and reliability through real-world customer insights, giving you a hands-on role in shaping a Stellar Cyber feature. In return, you'll receive early access to upcoming releases and the chance to guide product development.

The following EAP features are in this release:

MCP Server

The Stellar Cyber MCP Server connects supported AI clients to the Stellar Cyber Platform through the Model Context Protocol (MCP). The MCP server lets AI clients retrieve case and alert data, review investigation context, perform tenant-aware operations, and update selected case fields. This capability helps teams extend AI-assisted investigations by giving approved clients structured access to operational security data and workflows.

Parser Studio

Parser Studio lets you create and manage custom log parsers for data ingestion by cloning existing parsers, testing parser behavior before deployment, and activating parsers for production use. This capability helps you accelerate onboarding of custom log sources while reducing parser development effort and improving validation before live ingestion.

XDR Connector Webhook Ingestion

This is a simple webhook framework that lets you post JSON data directly from any external system into Stellar Cyber, accelerating custom integrations and expanding your visibility across the entire security stack. The XDR Connector is in Public Preview in this release.

Customizable Case Correlation Strategies

This EAP feature introduces support for multiple case correlation strategies, allowing teams to evaluate and experiment with different approaches to grouping alerts into cases. Each strategy provides a distinct investigative perspective:

  • Attacker-Centric Correlation groups alerts by the source (attacker) host, making it easier to track adversary behavior across multiple targets.

  • Victim-Centric Correlation organizes alerts by the destination (victim) host, enabling focused protection and visibility on high-value assets.

  • Multi-Entity Correlation links alerts across interconnected hosts and actions to form a single case, offering a holistic view of extended or lateral attack campaigns.

This flexibility enables security teams to tailor investigations based on their operational priorities—whether that’s identifying persistently targeted endpoints, tracing threat actor movements, or capturing full-scale intrusion campaigns.

Alert for Suspicious OCI Tenant-to-Tenant Communication

This EAP feature introduces a new alert type that detects cross-tenancy communications in the Oracle Cloud Infrastructure (OCI). By analyzing tenantId fields in audit logs, the feature identifies requests that target resources in a different tenancy. This provides accurate visibility into potentially unauthorized cross-tenancy activity and strengthens oversight in OCI environments.

To join the Early Access Program and begin testing these features, contact your Stellar Cyber Customer Success representative.

Resolved Issues

The following issues have been resolved in this release.

  • Resolved a bulk case action issue in which a typed tag was not applied if you selected Apply without first confirming the entry. The tag input is now committed before the bulk action request is sent, so the complete tag list is applied to the selected cases. Existing tag workflows that use Enter or an autocomplete selection continue to work as before.

  • Resolved a page-loading issue with the Cases page. The issue occurred when you opened the page directly from a URL, bookmark, or new browser tab that included query parameters. Previously, the page showed an error and failed to finish loading. The Cases page now opens reliably in these scenarios, so bookmarked and shared links work as expected.

  • Added runtime support for the Lightweight Directory Access Protocol (LDAP) libraries required by Linux Server Sensors on Debian 13. Previously, the Linux Server Sensor failed to start on Debian 13 because the required LDAP shared library was not available at runtime. Linux Server Sensors now start correctly on Debian 13 systems with the required LDAP runtime library support.

  • Restored preservation of the original casing in event_data.CommandLine and event_data.ParentCommandLine for Sysmon process creation events (Event ID 1). Previously, the pipeline lowercased these values, which altered case-sensitive content such as PowerShell -EncodedCommand arguments and prevented accurate decoding during analysis. Newly ingested events now retain the original command line casing, while detections continue to evaluate command lines case-insensitively where needed. Previously indexed events remain unchanged.

  • Fixed a normalization issue in the CEF parser that prevented the user_agent field in Check Point logs sent to port 5143 from being retained in parsed data. The issue occurred because the previous normalization logic did not correctly handle mapping user_agent to user_agent.original. After this fix, logs that include user_agent preserve the value correctly so it remains available for investigation and search.

  • Resolved a parsing issue in the Netscaler parser that incorrectly removed double quotation marks contained within the command field value. The parser now preserves quotation marks that are part of the original command content while still handling wrapper quotation marks correctly. This fix ensures that parsed command values remain accurate for investigation and review.

Stellar Cyber Platform System Requirements

You must install the Stellar Cyber Platform in an environment that meets or exceeds minimum system requirements. Refer to the following sections for the minimum system requirements for different target environments:

System Requirements for Cluster Installation in VMware ESXi

You can install the Stellar Cyber platform on a dedicated ESXi server running VMware ESXi 8.0, 7.0 or 6.7. The target ESXi server must have sufficient resources to support separate virtual machines for the cluster nodes required by your expected daily ingestion volume.

Refer to Stellar Cyber Platform (DP) System Requirements and Capacity Planning for details on the quantities of cluster nodes required for different daily ingestion volumes, as well as the system resources you must provision for their virtual machines.

Keep in mind the following:

  • Each VM  must be thick-provisioned.

  • You can install all of the VMs in the same datastore if there is sufficient space for both the VMs and the disk space required for the Data Lake's ElasticSearch data. However, Stellar Cyber recommends that the Data Lake uses a dedicated datastore.

Stellar Cyber supports SSD disks for both the OS and Data Lake drives (SATA, SAS, or NVMe). HDD disks introduce latency and are not supported.

Scaling Up Performance with a DP Cluster

You can configure up to ten DP servers to operate in a cluster to achieve improved Stellar Cyber performance. Stellar Cyber cluster testing indicates the following performance guidelines when adding additional DPs to a cluster:

  • With data replication disabled, the aggregated ingestion throughput grows linearly with the number of DP servers.

  • With data replication enabled (the default), the aggregated ingestion throughput is about 30% lower than the throughput without data replication.

Upgrading the Stellar Cyber Platform

You can upgrade the Stellar Cyber Platform from 6.3.0 or later to 6.5.0. You must:

  • Prepare for the upgrade

  • Upgrade the Stellar Cyber Platform to 6.5.0

  • Upgrade the sensors

  • Verify the upgrade

For more detailed instructions, refer to Upgrading Software.

Due to additional functionality and features, resource utilization (CPU and memory) might increase depending on your usage patterns. You can keep tabs on the platform's CPU and disk usage by clicking the Node List button in the System | Data Management | Data Analyzer page. If necessary, you can scale up your platform by adding DA and DL worker nodes, as described here for AWS, GCP, and OCI.

Important Note for Air-Gapped Environments: The 6.5.0 release requires connectivity to specific external URLs to enable components included in the installation image, such as Early Access Program functionality and various features and fixes. In air-gapped or dark site environments, where externasl network access is restricted, these components cannot be enabled after installation. Before upgrading to 6.5.0, confirm that the required connectivity to these URLs is available.

Prepare for the Upgrade

To prepare for the upgrade:

  • Back up the data and configuration
  • Make sure the sensors are up and running
  • Take note of the ingestion rate
  • Take note of the number of alerts
  • Make sure the system health indicator shows
  • Run the pre-upgrade check

Upgrade the Stellar Cyber Platform to 6.5.0

To upgrade the Stellar Cyber Platform to 6.5.0 from a version earlier than 6.3.0, first upgrade to 6.3.0.

  1. Select Settings | ORGANIZATION MANAGEMENT | Software Upgrade.

  2. Choose 6.5.0.

  3. Select START UPGRADE.

Upgrade the Sensors

New features, updated ML algorithms, and enhanced configurations may change ingestion and detection patterns. We recommend the following to ensure a smooth upgrade:

  • Upgrade sensors with the Sandbox and IDS features enabled before sensors with the only the Network Traffic feature enabled. Sensors with Network Traffic enabled send data to sensors with Sandbox and IDS enabled for additional processing.
  • Upgrade sensors in batches instead of all at once.
  • For server sensors (agents):
    • Upgrade a small set of sensors that cover non-critical assets.
    • After 24 hours, ensure that your ingestion is as expected, then upgrade a larger set.
    • After 24 hours, ensure that your ingestion is as expected, then upgrade the remaining server sensors.

CentOS 7.1 Prerequisite – Update curl to 7.29.0-59.el7_9.2 or Higher

Before upgrading any Linux Server Sensors running in CentOS 7.1, you must check your curl version and update it to 7.29.0-59.el7_9.2 or higher to use the strong encryption required by the Stellar Cyber Platform.

  1. Check your curl version as shown below:

    yum list installed curl

    \* Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Installed Packages curl.x86_64 7.29.0-19.el7

  2. If the listed version is lower than 7.29.0-59.el7_9.2 (as it is in the example above), use the following commands to update the curl package:

    yum makecache

    yum install curl

  3. If installation of the curl package fails, it is most likely because CentOS is trying to use a repo that has reached its end of life. Try updating the base URL and then reinstall curl. The following sed command makes the necessary changes for most environments to ensure that the updated curl package can be installed:

    sudo sed -i.bak -e 's|^mirrorlist=|#mirrorlist=|' -e 's|^#baseurl=http://mirror.centos.org/centos/\$releasever|baseurl=http://archive.kernel.org/centos-vault/7.9.2009|' /etc/yum.repos.d/CentOS-Base.repo

To upgrade sensors:

Depending on the type of server sensor, upgrade your sensors to version 6.5.0 as follows:

  • Linux Server Sensors: Upgrade directly to 6.5.0 from either of the two previous releases: 6.3.0 or 6.4.0.

  • Windows Server Sensors: Upgrade directly to 6.5.0 from an extended range of previous releases: 5.1.0 through 6.4.0.

    If you are upgrading a Windows Server Sensor, complete any pending updates for the host Windows machine before upgrading the sensor.

  1. Select System | DATA SOURCE MANAGEMENT | Sensors | Sensors.

    The Sensor List appears.

  2. Select Manage | Software Upgrade.

    The Sensor Software Upgrade page appears.

  3. Choose the target software version.

  4. Choose the target sensors.

  5. Select Submit.

Verify the Upgrade

To verify that the upgrade was successful:

  • Check the Current Software Version on the System | ORGANIZATION MANAGEMENT | Software Upgrade page.
  • Make sure the sensors are up and running.
  • Check the ingestion rate and make sure it is as expected.
  • Check the number of alerts and make sure it is as expected.
  • Check the system health indicator:
    • indicates a perfectly healthy system.
    • indicates minor issues. Monitor the system for 30 minutes. If the issues remain, investigate further.
    • indicates major issues. Contact Technical Support.